# Does personalization have to respect Global Privacy Control? | PersonalizeIQ

Source: https://personalizeiq.com/blog/global-privacy-control-personalization/

PersonalizeIQ answers


The Global Privacy Control signal tells sites the visitor opts out of sale or sharing under the CCPA. If your personalization sells or shares personal data, you must honor it.

## What Global Privacy Control does

Global Privacy Control is a browser signal that lets a person opt out of the sale or sharing of their personal information across every site they visit, without toggling settings on each one. Under the CCPA, a business that receives the signal must treat it as a valid opt-out request for that browser. It is not a cookie preference or a suggestion. It is a legal instruction.

The key question for personalization teams is whether their personalization counts as selling or sharing. If behavioral data leaves your systems, goes to an ad network, a data broker, or a personalization vendor that uses it for its own purposes, that is likely a sale or share under California law, and GPC applies.

## What honoring it looks like in practice

When the GPC signal arrives, the personalization that depends on sold or shared data has to stop for that visitor. That does not mean the site goes generic. First-party personalization built on data you collected yourself and never sold, like on-site behavior used only to rank your own products, generally continues. The line is the data flow, not the feature.

Implement it as a consent state, not a special case. Your consent system should already model opt-out; GPC becomes one more input that sets the same state. Test it the way you test every consent change: signal on, confirm the data flows stop, signal off, confirm they resume.

## The common mistakes

The most common mistake is ignoring the signal entirely because nobody filed a complaint yet. Enforcement has already happened against businesses that disregarded it. The second mistake is honoring it only in the cookie banner flow while the personalization vendor keeps receiving data server-side. Audit the actual data flows, not just the banner.

Document your position. Write down which personalization features you consider first-party and why, and have counsel review it. If a regulator asks, the memo matters more than the intent.

## Do I need to honor GPC if I am not based in California?

If you do business in California or process California residents' data above the CCPA thresholds, yes. Many businesses apply it universally because segmenting by state is harder than honoring it everywhere.

## Does GPC block all personalization?

No. It blocks personalization that relies on selling or sharing personal data. First-party, on-site personalization typically continues.

## How do I detect the signal?

Browsers send it as a Sec-GPC header and a navigator.globalPrivacyControl flag. Your consent platform should read both.

## Reviewed

Published Oct 1, 2026.

## Reviewed

Published Oct 1, 2026.